Attackers are hiding malware behind fake CAPTCHA and "verify you are human" pages that trick you into running the malicious command yourself. This method, known as ClickFix, shows a counterfeit verification form that tells you to press Win+R, paste a command that was silently copied to your clipboard, and hit Enter—which quietly runs malicious PowerShell on your machine. ClickFix has moved fast from novelty to dominant threat. Microsoft's analysis calls it a social-engineering technique where a fake CAPTCHA or error page walks the victim through executing the attack by hand.
Table of Contents
- How the fake CAPTCHA actually works
- Why it slips past antivirus and email filters
- How widespread this has become
- What lands on your machine, and who is targeted
- How to protect yourself
- Frequently Asked Questions
How the fake CAPTCHA actually works
The page looks routine. You visit a site, a familiar-looking "verify you are human" box appears, and it asks you to complete an unusual "verification step" instead of clicking a checkbox. That step is the trap. The page copies a command to your clipboard behind the scenes, then instructs you to open the Windows Run dialog with Win+R, paste, and press Enter.
When you do, Windows runs a PowerShell command that downloads and launches malware. The key detail is that you—not a piece of code—perform the action. That single design choice is why the technique succeeds against people who consider themselves careful. The forms often imitate trusted brands like Cloudflare Turnstile or Google reCAPTCHA to lower suspicion.
Why it slips past antivirus and email filters
ClickFix is dangerous because it sidesteps the defenses most people rely on. According to the Center for Internet Security, the victim types the command, so no malicious attachment or file lands on disk at the outset for a scanner to catch. Execution also relies on legitimate, built-in Windows tools such as PowerShell—often called "living off the land" binaries.
Because these programs are trusted and normally present, static antivirus, email filtering, and even some endpoint detection tools can miss the activity. The result is a technique that turns your own trust and your own keyboard into the delivery mechanism. There is no obvious "download and run this .exe" moment to trigger a warning.
How widespread this has become
ClickFix is no longer a fringe tactic. The Microsoft Digital Defense Report 2025 found it accounted for 47% of observed initial-access compromises, ahead of traditional phishing at 35%, making it the top way attackers first break in. The growth curve is steep.
ESET's H1 2025 Threat Report, covered by Infosecurity Magazine, recorded a 517% surge in ClickFix attacks in the first half of 2025—nearly 8% of all blocked threats and the second-most-common attack vector behind phishing. The people behind it range widely. Microsoft reports that nation-state groups—including Russia's APT28, North Korea's Kimsuky, and Iran's MuddyWater—adopted ClickFix in espionage operations between October 2024 and January 2025, alongside ordinary financially motivated criminals.
What lands on your machine, and who is targeted
The payloads are built to steal and to stay. Splunk's security research reports that fake CAPTCHAs primarily deliver infostealers such as Lumma Stealer and remote access trojans like NetSupport RAT—and some infection chains drop up to five distinct malware families at once. You do not have to go looking for these pages to encounter them.
The Hacker News reports victims are funneled to fake pages through malvertising, SEO poisoning, and compromised legitimate WordPress sites, with enterprises a prime target. The scope keeps expanding. The same reporting notes campaigns now detect your operating system to serve Windows, macOS, or Linux payloads, and a "FileFix" variant swaps the Run dialog for a fake File Explorer address bar—so the "paste here" instruction may not always mention Win+R.
How to protect yourself
The core defense is simple: a real CAPTCHA never asks you to run a command. If a "verification" step tells you to open a dialog, paste something, and press Enter, stop. Watch for these warning signs: Practical steps if you see one: For a deeper technical breakdown and defensive guidance, review Microsoft Security's ClickFix analysis.
- A CAPTCHA that asks you to press Win+R, Ctrl+V, or Enter
- Instructions to paste anything into the Run box, PowerShell, a terminal, or a File Explorer address bar
- A "human verification" or "fix this error" step that involves keyboard shortcuts
- Pages that appear after clicking a search result or ad and demand extra steps
- Close the tab; do not follow the instructions
Frequently Asked Questions
Can a real CAPTCHA ever ask me to press Win+R or paste a command?
No. Legitimate CAPTCHAs use checkboxes or image puzzles. Any request to run keyboard commands or paste text into a dialog is an attack.
I closed the page but didn't paste anything—am I infected?
If you never opened the Run box and pressed Enter, the command did not execute. Simply closing the tab is enough in that case.
Does this only affect Windows users?
No. The Hacker News reports campaigns now detect the operating system to serve Windows, macOS, and Linux payloads, so Mac and Linux users are also at risk.